chore(deps): update hashicorp/vault requirement from ~> 4.0 to ~> 5.12 in /terraform

[dependabot]

Updates the requirements on hashicorp/vault to permit the latest version.

Release notes

Sourced from hashicorp/vault's releases.

v5.12.0

5.12.0 (September 17, 2026)

FEATURES:

• New Resources: Add support for PKI External CA DNS-01 challenge providers with vault_pki_external_ca_secret_backend_dns_provider_aws_route53, vault_pki_external_ca_secret_backend_dns_provider_azure, vault_pki_external_ca_secret_backend_dns_provider_gcp, and vault_pki_external_ca_secret_backend_dns_provider_rfc2136 resources. Also adds default_nameserver to vault_pki_external_ca_secret_backend_acme_account and dns_provider_name/dns_provider_type to vault_pki_external_ca_secret_backend_role. Requires Vault 2.1.0 or later. (#3014)
• New Ephemeral Resource: vault_azure_access_token for fetching Azure OAuth2 access tokens from Vault's Azure secrets engine static role credentials. Requires Vault 2.2.0 or later. (#2974)
• New Resource for tokenization transforms: Add new resources vault_transform_transformation_tokenization and vault_transform_transformation_tokenization_store for tokenization transformations in transform secrets engine and tokenization stores. Uses this endpoint to support creating and updating of tokenization transformations and this endpoint for tokenization stores. Supported parameters include name, mapping_mode, max_ttl, allowed_roles, stores, convergent, deletion_allowed for vault_transform_transformation_tokenization and name, type, driver, connection_string, username, password, supported_transformations, schema, max_open_connections, max_idle_connections, max_connection_lifetime for vault_transform_transformation_tokenization_store. (#3023)
• vault_azure_auth_backend_config: Add auth_type field to explicitly control how Vault authenticates to Azure APIs. Valid values are root_creds, plugin_wif, msi, and aks_wif. When omitted, Vault retains its existing credential-discovery behaviour for backward compatibility (#2999). Requires Vault 2.2.0+.

IMPROVEMENTS:

• vault_cert_auth_backend_role: Add certificate_wo and certificate_wo_version write-only fields to allow ephemeral resource values, to supply the CA certificate. The certificate field is now Computed and ForceNew has been removed enabling in-place updates when the certificate changes instead of resource replacement. (#3011)
• vault_ldap_auth_backend: emit a warning when the auth mount or its config is not found during refresh, so users see an actionable message in terraform plan output rather than a silent state removal. (#2997)
• Update supported Vault version for PKI formats pkcs12_bundle and jks_bundle to require Vault 2.1.0+ (not 2.0.5+) per latest Vault versioning strategy. (#3017#2950)

BUG FIXES:

• vault_mount: Fix spurious ForceNew destroy when importing a kv-v2 mount. Vault returns type=kv+options.version=2 on import; a DiffSuppressFunc now suppresses the kv/kv-v2 alias diff so the next plan is clean. (#3007)
• vault_terraform_cloud_secret_backend: Fix logic gap in Read where execution would fall through to a stray GET <backend>/config call after readMount detected the mount was deleted out-of-band and cleared the resource ID. Add util.Is404 guard to Delete so that terraform destroy succeeds cleanly when the mount has already been removed from Vault. (#3006)

BUILD:

Add support for linux/s390x architecture. (#3028)

DEPENDENCIES:

• Build with Go 1.27.1
• Bumped 20 Go module dependencies (#3036)
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0 → v1.23.1
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 → v1.14.1
• github.com/aws/aws-sdk-go-v2 v1.43.5 → v1.47.0
• github.com/aws/aws-sdk-go-v2/config v1.32.36 → v1.33.5
• github.com/aws/aws-sdk-go-v2/credentials v1.19.35 → v1.20.5
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.36 → v1.20.0
• github.com/aws/aws-sdk-go-v2/service/iam v1.59.0 → v1.64.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.45.5 → v1.51.0
• github.com/aws/smithy-go v1.27.7 → v1.28.1
• github.com/go-sql-driver/mysql v1.10.0 → v1.10.1
• github.com/hashicorp/vault-plugin-auth-jwt v0.26.3 → v0.27.1
• github.com/moby/moby/client v0.5.1 → v0.6.0
• github.com/stretchr/testify v1.11.1 → v1.12.1
• golang.org/x/crypto v0.55.0 → v0.57.0
• golang.org/x/oauth2 v0.36.0 → v0.37.0
• google.golang.org/api v0.293.0 → v0.298.0
• github.com/hashicorp/consul/api v1.34.4 → v1.34.5
• github.com/hashicorp/vault-plugin-auth-kerberos v0.17.1 → v0.18.0
• github.com/hashicorp/vault-plugin-auth-oci v0.21.3 → v0.22.0
• golang.org/x/net v0.58.0 → v0.59.0

... (truncated)

Changelog

Sourced from hashicorp/vault's changelog.

5.12.0 (September 17, 2026)

FEATURES:

• New Resources: Add support for PKI External CA DNS-01 challenge providers with vault_pki_external_ca_secret_backend_dns_provider_aws_route53, vault_pki_external_ca_secret_backend_dns_provider_azure, vault_pki_external_ca_secret_backend_dns_provider_gcp, and vault_pki_external_ca_secret_backend_dns_provider_rfc2136 resources. Also adds default_nameserver to vault_pki_external_ca_secret_backend_acme_account and dns_provider_name/dns_provider_type to vault_pki_external_ca_secret_backend_role. Requires Vault 2.1.0 or later. (#3014)
• New Ephemeral Resource: vault_azure_access_token for fetching Azure OAuth2 access tokens from Vault's Azure secrets engine static role credentials. Requires Vault 2.2.0 or later. (#2974)
• New Resource for tokenization transforms: Add new resources vault_transform_transformation_tokenization and vault_transform_transformation_tokenization_store for tokenization transformations in transform secrets engine and tokenization stores. Uses this endpoint to support creating and updating of tokenization transformations and this endpoint for tokenization stores. Supported parameters include name, mapping_mode, max_ttl, allowed_roles, stores, convergent, deletion_allowed for vault_transform_transformation_tokenization and name, type, driver, connection_string, username, password, supported_transformations, schema, max_open_connections, max_idle_connections, max_connection_lifetime for vault_transform_transformation_tokenization_store. (#3023)
• vault_azure_auth_backend_config: Add auth_type field to explicitly control how Vault authenticates to Azure APIs. Valid values are root_creds, plugin_wif, msi, and aks_wif. When omitted, Vault retains its existing credential-discovery behaviour for backward compatibility (#2999). Requires Vault 2.2.0+.

IMPROVEMENTS:

• vault_cert_auth_backend_role: Add certificate_wo and certificate_wo_version write-only fields to allow ephemeral resource values, to supply the CA certificate. The certificate field is now Computed and ForceNew has been removed enabling in-place updates when the certificate changes instead of resource replacement. (#3011)
• vault_ldap_auth_backend: emit a warning when the auth mount or its config is not found during refresh, so users see an actionable message in terraform plan output rather than a silent state removal. (#2997)
• Update supported Vault version for PKI formats pkcs12_bundle and jks_bundle to require Vault 2.1.0+ (not 2.0.5+) per latest Vault versioning strategy. (#3017#2950)

BUG FIXES:

• vault_mount: Fix spurious ForceNew destroy when importing a kv-v2 mount. Vault returns type=kv+options.version=2 on import; a DiffSuppressFunc now suppresses the kv/kv-v2 alias diff so the next plan is clean. (#3007)
• vault_terraform_cloud_secret_backend: Fix logic gap in Read where execution would fall through to a stray GET <backend>/config call after readMount detected the mount was deleted out-of-band and cleared the resource ID. Add util.Is404 guard to Delete so that terraform destroy succeeds cleanly when the mount has already been removed from Vault. (#3006)

BUILD:

Add support for linux/s390x architecture. (#3028)

DEPENDENCIES:

• Build with Go 1.27.1
• Bumped 20 Go module dependencies (#3036)
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0 → v1.23.1
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 → v1.14.1
• github.com/aws/aws-sdk-go-v2 v1.43.5 → v1.47.0
• github.com/aws/aws-sdk-go-v2/config v1.32.36 → v1.33.5
• github.com/aws/aws-sdk-go-v2/credentials v1.19.35 → v1.20.5
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.36 → v1.20.0
• github.com/aws/aws-sdk-go-v2/service/iam v1.59.0 → v1.64.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.45.5 → v1.51.0
• github.com/aws/smithy-go v1.27.7 → v1.28.1
• github.com/go-sql-driver/mysql v1.10.0 → v1.10.1
• github.com/hashicorp/vault-plugin-auth-jwt v0.26.3 → v0.27.1
• github.com/moby/moby/client v0.5.1 → v0.6.0
• github.com/stretchr/testify v1.11.1 → v1.12.1
• golang.org/x/crypto v0.55.0 → v0.57.0
• golang.org/x/oauth2 v0.36.0 → v0.37.0
• google.golang.org/api v0.293.0 → v0.298.0
• github.com/hashicorp/consul/api v1.34.4 → v1.34.5
• github.com/hashicorp/vault-plugin-auth-kerberos v0.17.1 → v0.18.0
• github.com/hashicorp/vault-plugin-auth-oci v0.21.3 → v0.22.0
• golang.org/x/net v0.58.0 → v0.59.0

... (truncated)

Commits

• 21dc65a Release v5.12.0 preparation (#3047)
• 670d3bf quick doc change for vault version for agentic workflows (#3048)
• 0c369e3 build(deps): bump github.com/moby/go-archive from 0.1.0 to 0.3.0 (#3009)
• c739a33 Add linux/s390x build target for IBM Z / LinuxONE (#3028)
• a02cc5d PKI External CA: Add DNS provider resources and default_nameserver support (#...
• 0595f04 build(deps): bump the gomod-backward-compatible group across 1 directory with...
• 2b0ce47 Add terraform resource for tokenization transformation for transform … (#3023)
• 085afe7 vault_cert_auth_backend_role: add write-only certificate support (#3011)
• f66bd39 Updated the version for okta group fetching vault feature (#3033)
• 34b28a0 Update auth type in Vault Azure Auth Method from aks_wi to aks_wif (#3031)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, terraform. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.